Skip to content
  1. Apr 26, 2019
  2. Apr 25, 2019
  3. Apr 24, 2019
  4. Apr 23, 2019
  5. Apr 20, 2019
  6. Apr 19, 2019
  7. Apr 18, 2019
  8. Apr 17, 2019
    • Chris Wilson's avatar
      drm/i915: Avoid use-after-free in reporting create.size · 99534023
      Chris Wilson authored
      
      
      We have to avoid chasing after a userspace race!
      
      <3>[  473.114328] BUG: KASAN: use-after-free in i915_gem_create+0x1d2/0x1f0 [i915]
      <3>[  473.114389] Read of size 8 at addr ffff88815bf1d840 by task gem_flink_race/1541
      
      <4>[  473.114464] CPU: 1 PID: 1541 Comm: gem_flink_race Tainted: G     U            5.1.0-rc4-g7d07e025e786-kasan_88+ #1
      <4>[  473.114469] Hardware name: To Be Filled By O.E.M. To Be Filled By O.E.M./J4205-ITX, BIOS P1.10 09/29/2016
      <4>[  473.114474] Call Trace:
      <4>[  473.114488]  dump_stack+0x7c/0xbb
      <4>[  473.114612]  ? i915_gem_create+0x1d2/0x1f0 [i915]
      <4>[  473.114621]  print_address_description+0x65/0x270
      <4>[  473.114728]  ? i915_gem_create+0x1d2/0x1f0 [i915]
      <4>[  473.114839]  ? i915_gem_create+0x1d2/0x1f0 [i915]
      <4>[  473.114848]  kasan_report+0x149/0x18d
      <4>[  473.114962]  ? i915_gem_create+0x1d2/0x1f0 [i915]
      <4>[  473.115069]  i915_gem_create+0x1d2/0x1f0 [i915]
      <4>[  473.115176]  ? i915_gem_object_create.part.28+0x4b0/0x4b0 [i915]
      <4>[  473.115289]  ? i915_gem_dumb_create+0x1a0/0x1a0 [i915]
      <4>[  473.115297]  drm_ioctl_kernel+0x192/0x260
      <4>[  473.115306]  ? drm_ioctl_permit+0x280/0x280
      <4>[  473.115326]  drm_ioctl+0x67c/0x960
      <4>[  473.115438]  ? i915_gem_dumb_create+0x1a0/0x1a0 [i915]
      <4>[  473.115448]  ? drm_getstats+0x20/0x20
      <4>[  473.115459]  ? __lock_acquire+0xa66/0x3fe0
      <4>[  473.115474]  ? _raw_spin_unlock_irqrestore+0x39/0x60
      <4>[  473.115485]  ? debug_object_active_state+0x2ea/0x4e0
      <4>[  473.115496]  ? debug_show_all_locks+0x2d0/0x2d0
      <4>[  473.115513]  do_vfs_ioctl+0x18d/0xfa0
      <4>[  473.115522]  ? check_flags.part.27+0x440/0x440
      <4>[  473.115532]  ? ioctl_preallocate+0x1a0/0x1a0
      <4>[  473.115547]  ? __fget+0x2ac/0x410
      <4>[  473.115561]  ? __ia32_sys_dup3+0xb0/0xb0
      <4>[  473.115569]  ? rwlock_bug.part.0+0x90/0x90
      <4>[  473.115590]  ksys_ioctl+0x35/0x70
      <4>[  473.115597]  ? lockdep_hardirqs_off+0x1cb/0x2b0
      <4>[  473.115608]  __x64_sys_ioctl+0x6a/0xb0
      <4>[  473.115614]  ? lockdep_hardirqs_on+0x342/0x590
      <4>[  473.115623]  do_syscall_64+0x97/0x400
      <4>[  473.115633]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
      <4>[  473.115641] RIP: 0033:0x7fce590d55d7
      <4>[  473.115649] Code: b3 66 90 48 8b 05 b1 48 2d 00 64 c7 00 26 00 00 00 48 c7 c0 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 81 48 2d 00 f7 d8 64 89 01 48
      <4>[  473.115655] RSP: 002b:00007fce4d525ba8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
      <4>[  473.115662] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fce590d55d7
      <4>[  473.115667] RDX: 00007fce4d525c10 RSI: 00000000c010645b RDI: 0000000000000007
      <4>[  473.115672] RBP: 00007fce4d525c10 R08: 00007fce4d526700 R09: 00007fce4d526700
      <4>[  473.115677] R10: 0000000000000054 R11: 0000000000000246 R12: 00000000c010645b
      <4>[  473.115682] R13: 0000000000000007 R14: 0000000000000000 R15: 00007ffe0e4a7450
      
      <3>[  473.115731] Allocated by task 1541:
      <4>[  473.115766]  kmem_cache_alloc+0xce/0x290
      <4>[  473.115895]  i915_gem_object_create.part.28+0x1c/0x4b0 [i915]
      <4>[  473.116000]  i915_gem_create+0xe3/0x1f0 [i915]
      <4>[  473.116008]  drm_ioctl_kernel+0x192/0x260
      <4>[  473.116013]  drm_ioctl+0x67c/0x960
      <4>[  473.116020]  do_vfs_ioctl+0x18d/0xfa0
      <4>[  473.116026]  ksys_ioctl+0x35/0x70
      <4>[  473.116032]  __x64_sys_ioctl+0x6a/0xb0
      <4>[  473.116038]  do_syscall_64+0x97/0x400
      <4>[  473.116044]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
      
      <3>[  473.116071] Freed by task 1542:
      <4>[  473.116101]  kmem_cache_free+0xb7/0x2f0
      <4>[  473.116205]  __i915_gem_free_objects+0x7d4/0xe10 [i915]
      <4>[  473.116311]  i915_gem_create_ioctl+0xaa/0xd0 [i915]
      <4>[  473.116318]  drm_ioctl_kernel+0x192/0x260
      <4>[  473.116323]  drm_ioctl+0x67c/0x960
      <4>[  473.116330]  do_vfs_ioctl+0x18d/0xfa0
      <4>[  473.116335]  ksys_ioctl+0x35/0x70
      <4>[  473.116341]  __x64_sys_ioctl+0x6a/0xb0
      <4>[  473.116347]  do_syscall_64+0x97/0x400
      <4>[  473.116354]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
      
      Testcase: igt/gem_flink_race/flink_close
      Fixes: e163484a ("drm/i915: Update size upon return from GEM_CREATE")
      Signed-off-by: default avatarChris Wilson <chris@chris-wilson.co.uk>
      Cc: Michał Winiarski <michal.winiarski@intel.com>
      Reviewed-by: default avatarTvrtko Ursulin <tvrtko.ursulin@intel.com>
      Link: https://patchwork.freedesktop.org/patch/msgid/20190417132507.27133-1-chris@chris-wilson.co.uk
      99534023
    • Chris Wilson's avatar
      drm/i915: Make workaround verification *optional* · 769f0dab
      Chris Wilson authored
      Sometimes the HW doesn't even play fair, and completely forgets about
      register writes. Skip verifying known troublemakers.
      
      References: https://bugs.freedesktop.org/show_bug.cgi?id=108954
      
      
      Signed-off-by: default avatarChris Wilson <chris@chris-wilson.co.uk>
      Cc: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
      Reviewed-by: default avatarTvrtko Ursulin <tvrtko.ursulin@intel.com>
      Link: https://patchwork.freedesktop.org/patch/msgid/20190417075657.19456-4-chris@chris-wilson.co.uk
      769f0dab
Loading